votetanec.ru Open in urlscan Pro
188.114.97.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://votetanec.ru/home/voting174
Submission: On June 21 via manual (June 21st 2024, 7:56:07 am UTC) from RU — Scanned from NL

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 5 countries across 7 domains to perform 17 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is votetanec.ru.
TLS certificate: Issued by WE1 on June 17th 2024. Valid for: 3 months.

This is the only time votetanec.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 11	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	91.215.42.162 91.215.42.162	57724 (DDOS-GUARD) (DDOS-GUARD)
1	2a00:ab00:610... 2a00:ab00:610:1::1	49505 (SELECTEL) (SELECTEL)
1	2a00:1450:400... 2a00:1450:4001:810::200a	15169 (GOOGLE) (GOOGLE)
1	37.59.196.79 37.59.196.79	16276 (OVH) (OVH)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
17	7

11 188.114.97.3 (Amsterdam, Netherlands) 1 redirects

ASN13335 (CLOUDFLARENET, US)

votetanec.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.215.42.162 (Russian Federation)

ASN57724 (DDOS-GUARD, RU)

www.mgpu.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:ab00:610:1::1 (Russian Federation)

ASN49505 (SELECTEL, RU)

259506.selcdn.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.59.196.79 (Paris, France)

ASN16276 (OVH, FR)
PTR: ip79.ip-37-59-196.eu

kartinki.pics	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	votetanec.ru 1 redirects votetanec.ru	96 KB
2	gstatic.com fonts.gstatic.com	54 KB
1	kartinki.pics kartinki.pics — Cisco Umbrella Rank: 870395	78 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 83	1 KB
1	selcdn.ru 259506.selcdn.ru	27 KB
1	mgpu.ru www.mgpu.ru	907 KB
0	google.com Failed www.google.com Failed
17	7

	Domain	Requested by
11	votetanec.ru	1 redirects votetanec.ru
2	fonts.gstatic.com	fonts.googleapis.com
1	kartinki.pics	votetanec.ru
1	fonts.googleapis.com	votetanec.ru
1	259506.selcdn.ru	votetanec.ru
1	www.mgpu.ru	votetanec.ru
0	www.google.com Failed
17	7

This site contains no links.

Subject Issuer	Validity	Valid
votetanec.ru WE1	`2024-06-17` - `2024-09-15`	3 months	crt.sh
*.mgpu.ru GlobalSign GCC R6 AlphaSSL CA 2023	`2024-03-13` - `2025-04-14`	a year	crt.sh
*.selcdn.ru AlphaSSL CA - SHA256 - G4	`2023-11-24` - `2024-12-25`	a year	crt.sh
upload.video.google.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh
kartinki.pics R3	`2024-04-16` - `2024-07-15`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-03` - `2024-08-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://votetanec.ru/home/voting174
Frame ID: DED833717C15BF7C34B965C6DFAEE48D
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Конкурс

Page URL History Show full URLs

https://votetanec.ru/home/voting174 Page URL
https://votetanec.ru/cdn-cgi/phish-bypass?atok=kUah0CljH0G_c2XaJAZ3DabPBc2E_e6WdK7oCwI.BjY-171895... HTTP 301
https://votetanec.ru/home/voting174 Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

SweetAlert2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

sweetalert2(?:\.all)?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

94 %
HTTPS

50 %
IPv6

7
Domains

7
Subdomains

7
IPs

5
Countries

1164 kB
Transfer

1342 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://votetanec.ru/home/voting174 Page URL
https://votetanec.ru/cdn-cgi/phish-bypass?atok=kUah0CljH0G_c2XaJAZ3DabPBc2E_e6WdK7oCwI.BjY-1718956558-0.0.1.1-%2Fhome%2Fvoting174 HTTP 301
https://votetanec.ru/home/voting174 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://votetanec.ru/favicon.ico HTTP 302
https://google.com/ HTTP 301
https://www.google.com/

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 voting174 Show response
votetanec.ru/home/ 4 KB
2 KB 1754ms
66ms Document
text/html 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://votetanec.ru/home/voting174

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5de149359e519acf3f29457bb263897a4dc3966d1d5db811f22c838caa21ae2b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cf-ray: 89727078d9801d9a-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 21 Jun 2024 07:55:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=esP1sqDCr6aHcOV5vBwOJ5njGwKIZnjGF3T2P3ZrWI00cEXG7beyvP%2BW1zwadtx2fjmtCthcqqOvA7L59DTwl8tg%2BxccZQtm%2FGta%2Figf%2B%2FJlS3yAwDlnJk%2B%2Bk3918P4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H3 200 cf.errors.css
votetanec.ru/cdn-cgi/styles/ 23 KB
5 KB 31ms
30ms Stylesheet
text/css 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://votetanec.ru/cdn-cgi/styles/cf.errors.css

Requested by

Host: votetanec.ru
URL: https://votetanec.ru/home/voting174

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/home/voting174
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 07:55:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 19 Jun 2024 08:39:00 GMT
server: cloudflare
etag: W/"66729924-5df3"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 897270797a541d9a-FRA
expires: Fri, 21 Jun 2024 09:55:58 GMT

GET
H3 200 icon-exclamation.png
votetanec.ru/cdn-cgi/images/ 452 B
634 B 51ms
46ms Image
image/png 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://votetanec.ru/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: votetanec.ru
URL: https://votetanec.ru/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/cdn-cgi/styles/cf.errors.css
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 07:55:58 GMT
x-content-type-options: nosniff
last-modified: Wed, 19 Jun 2024 08:39:00 GMT
server: cloudflare
etag: "66729924-1c4"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 89727079eac51d9a-FRA
content-length: 452
expires: Fri, 21 Jun 2024 09:55:58 GMT

GET

/
www.google.com/
Redirect Chain

https://votetanec.ru/favicon.ico
https://google.com/
https://www.google.com/

0
0

GET
H3

200

Primary Request voting174 Show response
votetanec.ru/home/
Redirect Chain

https://votetanec.ru/cdn-cgi/phish-bypass?atok=kUah0CljH0G_c2XaJAZ3DabPBc2E_e6WdK7oCwI.BjY-1718956558-0.0.1.1-%2Fhome%2Fvoting174
https://votetanec.ru/home/voting174

14 KB
4 KB

159ms
158ms

Document
text/html

188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://votetanec.ru/home/voting174
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2d27ac72d741a1d6f50d65dc14e08d46408ea407fb2f9755c40153de6f7a6a1

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Referer: https://votetanec.ru/home/voting174
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 897270917b5f1d9a-FRA
content-encoding: zstd
content-type: text/html; charset=utf-8
date: Fri, 21 Jun 2024 07:56:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Un8ICLW8JD50xJJ%2FWsmhuyZmrVf9l5qt%2Btgv3GG8MxTzewOzGTRw5JA9uHK5JcN%2BRwfp3eqD%2BWKx8E4JK5TDOg1r5scPaWid7RhQLq9eCc98AFtwzJflcG8VCsJpOiU%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

cache-control: private, no-cache
cf-ray: 897270911adf1d9a-FRA
content-length: 167
content-type: text/html
date: Fri, 21 Jun 2024 07:56:02 GMT
location: https://votetanec.ru/home/voting174
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 integrated.css
votetanec.ru/static/css/ 5 KB
2 KB 60ms
59ms Stylesheet
text/css 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://votetanec.ru/static/css/integrated.css
Requested by: Host: votetanec.ru
URL: https://votetanec.ru/home/voting174
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a97a863d99ed6c5d20ca0380eb08c80286a7ff6dedafef98d096f5a0efc1b18

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/home/voting174
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 07:56:02 GMT
content-encoding: zstd
cf-cache-status: HIT
last-modified: Wed, 19 Jun 2024 22:05:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4811
etag: W/"17da8711aaa7ed30-1320"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HpVRK4nyBwfhTGlJYgopcfQJif2N%2FORhXbs5AbNUOt3NNHZL6sAANjTugo%2BYKslfdKGlbnlE7ETQ40CujgtNdwvK6VpgPJN6wylBgm64Ey4AWKDzI4vaadAjkPvNgfw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 897270929cb31d9a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery.js Show response
votetanec.ru/static/js/lib/ 85 KB
32 KB 39ms
37ms Script
application/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://votetanec.ru/static/js/lib/jquery.js
Requested by: Host: votetanec.ru
URL: https://votetanec.ru/home/voting174
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f764efbb2cdb303e3019325d811225ead27d656f8b40390de427db1415dc56a

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/home/voting174
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 07:56:02 GMT
content-encoding: zstd
cf-cache-status: HIT
last-modified: Sat, 08 Jun 2024 20:54:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4811
etag: W/"17d722ce557adf15-155a5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CsbIe30z5nzRoOT8J0wUmiQmp7imhHFdHihOGMfXpHF8MWhlCPeSTrmMAJVSa4%2Fte3%2FIFD7lDUjSHgrZQ57WlvDAHdxax21OIfR7%2BXeAhPn9I9okagdo602ysXqnfJg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 897270929cb71d9a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 sweetalert2.js Show response
votetanec.ru/static/js/lib/ 74 KB
22 KB 79ms
77ms Script
application/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://votetanec.ru/static/js/lib/sweetalert2.js
Requested by: Host: votetanec.ru
URL: https://votetanec.ru/home/voting174
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e2c817caddaf3c76032e874ddda1dec9ec74e3ab28d6dfbd61b0c41ec8136e5

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/home/voting174
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 07:56:02 GMT
content-encoding: zstd
cf-cache-status: HIT
last-modified: Sat, 08 Jun 2024 20:54:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4811
etag: W/"17d722ce557adf15-12907"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DnSCKegBD0wjN8njXwALJrDDic8QP2ZGhNQu03IEoFeKlo1fOX%2F%2FKqE1AtHObb0HnUVFlOp5AQp7icQzTADAYsyU%2BAi6yK7VasW41qsWEbRNFdSYwiRxusR2v0mdjuU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 897270929cb91d9a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 integrated.js Show response
votetanec.ru/static/js/ 995 B
843 B 82ms
81ms Script
application/javascript 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://votetanec.ru/static/js/integrated.js
Requested by: Host: votetanec.ru
URL: https://votetanec.ru/home/voting174
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a862b97e104af0270010a0fe9343f418f60e2ac269c3d32cdf22742c329feda

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/home/voting174
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 07:56:02 GMT
content-encoding: zstd
cf-cache-status: HIT
last-modified: Sat, 08 Jun 2024 20:54:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4811
etag: W/"17d722ce566f033b-3e3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZV32TxOrwbGOhtUM5VVJKKs%2FSAMzEC4bmnLGt0nj2oYcJvRFpg%2Fs3Sk0DM4%2BucXJkYYIcfndXVmcsIEdakriIqAkEB5Rp6s%2BHiDfzHhBwvv0JQ8RqOOJJkAIlS1HICw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 897270929cbb1d9a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 logo.png
votetanec.ru/static/integrated/ 27 KB
27 KB 83ms
81ms Image
image/png 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://votetanec.ru/static/integrated/logo.png
Requested by: Host: votetanec.ru
URL: https://votetanec.ru/home/voting174
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 20e9c16713edf2f62880b40500895077a27188ef4096868ecf45bb10a773ac2c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/home/voting174
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 07:56:02 GMT
cf-cache-status: HIT
last-modified: Sat, 08 Jun 2024 20:54:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4811
etag: "17d722ce5ca1ee2f-6b98"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=blPV%2FAwc6VVtA8p135ZT1j02fp2HNm286kjnTigp2a%2FYe7J%2BBH9Jp9JxKGzd3oftkeoKeADSRHJxNj0fOUOEKPnDVHJPQ6R4Ypv%2FrXjXhY%2BuD4aV4Vsd3xVyR4Lvc2E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 897270929cbe1d9a-FRA
alt-svc: h3=":443"; ma=86400
content-length: 27544

GET
H2 200 7yhwOW9L07I.jpg
www.mgpu.ru/wp-content/uploads/2021/04/ 906 KB
907 KB 218ms
168ms Image
image/jpeg 91.215.42.162
DDOS-GUARD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mgpu.ru/wp-content/uploads/2021/04/7yhwOW9L07I.jpg

Requested by

Host: votetanec.ru
URL: https://votetanec.ru/home/voting174

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

91.215.42.162 , Russian Federation, ASN57724 (DDOS-GUARD, RU),

Reverse DNS

Software

ddos-guard /

Resource Hash

4494e317e68a12451d4336425cab83d5c4976c7ec6273c3237c09e50a819b583

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: upgrade-insecure-requests;
date: Fri, 21 Jun 2024 07:56:02 GMT
last-modified: Tue, 13 Apr 2021 20:01:37 GMT
server: ddos-guard
etag: "6075f8a1-e287a"
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 927866
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 36b18e0b-0e9f-4e73-9829-023e7dbe3a30-3787323.jpeg
259506.selcdn.ru/sites-static/site672851/36b18e0b-0e9f-4e73-9829-023e7dbe3a30/ 27 KB
27 KB 268ms
81ms Image
image/jpeg 2a00:ab00:610:1::1
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://259506.selcdn.ru/sites-static/site672851/36b18e0b-0e9f-4e73-9829-023e7dbe3a30/36b18e0b-0e9f-4e73-9829-023e7dbe3a30-3787323.jpeg
Requested by: Host: votetanec.ru
URL: https://votetanec.ru/home/voting174
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:ab00:610:1::1 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software: /
Resource Hash: c2e61cca5b7933968892a0dcc4c00f1dbfae5c8072337908143f4b1c8b4b7cc2

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-container-storage-policy-name: Policy-0
date: Fri, 21 Jun 2024 06:24:32 GMT
last-modified: Tue, 15 Nov 2022 17:41:33 GMT
age: 5490
etag: "3bae951fa993ce52d29e9191fe210ec8"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges, Cache-Control
cache-control: public, max-age=604800
x-timestamp: 1668534092.45963
x-container-storage-policy-index: 0
accept-ranges: bytes
content-length: 27277
x-trans-id: 1727d2eab4a47ede

GET
H2 200 css2
fonts.googleapis.com/ 16 KB
1 KB 193ms
30ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@100;200;300;400;500;600;700;800;900&display=swap

Requested by

Host: votetanec.ru
URL: https://votetanec.ru/static/css/integrated.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f1e4c18549167223af672ff319ac7293d52e09fd02544d08d4166078b5f36c4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 21 Jun 2024 07:56:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 21 Jun 2024 06:09:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 21 Jun 2024 07:56:02 GMT

GET
H2 200 1606687653_25-p-fioletovii-fon-dlya-prezentatsii-27.jpg
kartinki.pics/uploads/posts/2020-11/ 78 KB
78 KB 220ms
61ms Image
image/jpeg 37.59.196.79
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://kartinki.pics/uploads/posts/2020-11/1606687653_25-p-fioletovii-fon-dlya-prezentatsii-27.jpg
Requested by: Host: votetanec.ru
URL: https://votetanec.ru/home/voting174
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 37.59.196.79 Paris, France, ASN16276 (OVH, FR),
Reverse DNS: ip79.ip-37-59-196.eu
Software: nginx /
Resource Hash: aedc078fb0391f88248a0032777517c8a45812e907c45877d11f5edacb699ad5

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 07:56:02 GMT
last-modified: Sun, 29 Nov 2020 22:06:55 GMT
server: nginx
etag: "5fc41b7f-138d0"
content-type: image/jpeg
cache-control: max-age=86400
accept-ranges: bytes
content-length: 80080
expires: Sat, 22 Jun 2024 07:56:02 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
32 KB 190ms
39ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@100;200;300;400;500;600;700;800;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://votetanec.ru
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 15:27:45 GMT
x-content-type-options: nosniff
age: 232097
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Jun 2025 15:27:45 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2
fonts.gstatic.com/s/montserrat/v26/ 21 KB
21 KB 166ms
21ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@100;200;300;400;500;600;700;800;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

637f545351fbed7e7207fdf36e1381b0860f12fffde46a6fa43bdafcc7a05758

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://votetanec.ru
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 14:57:57 GMT
x-content-type-options: nosniff
age: 233885
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21288
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:43:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 Jun 2025 14:57:57 GMT

GET
H3 200 logo.png
votetanec.ru/static/integrated/ 27 KB
0 0ms
0ms Other
image/png 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://votetanec.ru/static/integrated/logo.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 20e9c16713edf2f62880b40500895077a27188ef4096868ecf45bb10a773ac2c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://votetanec.ru/home/voting174
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 21 Jun 2024 07:56:02 GMT
cf-cache-status: HIT
last-modified: Sat, 08 Jun 2024 20:54:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4811
etag: "17d722ce5ca1ee2f-6b98"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=blPV%2FAwc6VVtA8p135ZT1j02fp2HNm286kjnTigp2a%2FYe7J%2BBH9Jp9JxKGzd3oftkeoKeADSRHJxNj0fOUOEKPnDVHJPQ6R4Ypv%2FrXjXhY%2BuD4aV4Vsd3xVyR4Lvc2E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 897270929cbe1d9a-FRA
alt-svc: h3=":443"; ma=86400
content-length: 27544

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google.com
URL: https://www.google.com/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.votetanec.ru/	1970-01-20 21:30:42	Name: __cf_mw_byp Value: kUah0CljH0G_c2XaJAZ3DabPBc2E_e6WdK7oCwI.BjY-1718956558-0.0.1.1-/home/voting174
			votetanec.ru/	1970-01-21 07:05:16	Name: language Value: en

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

259506.selcdn.ru
fonts.googleapis.com
fonts.gstatic.com
kartinki.pics
votetanec.ru
www.google.com
www.mgpu.ru
www.google.com
188.114.97.3
2a00:1450:4001:810::200a
2a00:1450:4001:82f::2003
2a00:ab00:610:1::1
37.59.196.79
91.215.42.162
1e2c817caddaf3c76032e874ddda1dec9ec74e3ab28d6dfbd61b0c41ec8136e5
20e9c16713edf2f62880b40500895077a27188ef4096868ecf45bb10a773ac2c
4494e317e68a12451d4336425cab83d5c4976c7ec6273c3237c09e50a819b583
4a97a863d99ed6c5d20ca0380eb08c80286a7ff6dedafef98d096f5a0efc1b18
5de149359e519acf3f29457bb263897a4dc3966d1d5db811f22c838caa21ae2b
637f545351fbed7e7207fdf36e1381b0860f12fffde46a6fa43bdafcc7a05758
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8f764efbb2cdb303e3019325d811225ead27d656f8b40390de427db1415dc56a
9a862b97e104af0270010a0fe9343f418f60e2ac269c3d32cdf22742c329feda
a2d27ac72d741a1d6f50d65dc14e08d46408ea407fb2f9755c40153de6f7a6a1
aedc078fb0391f88248a0032777517c8a45812e907c45877d11f5edacb699ad5
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
c2e61cca5b7933968892a0dcc4c00f1dbfae5c8072337908143f4b1c8b4b7cc2
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f1e4c18549167223af672ff319ac7293d52e09fd02544d08d4166078b5f36c4d

votetanec.ru Open in urlscan Pro 188.114.97.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

94 %HTTPS

50 %IPv6

7 Domains

7 Subdomains

7 IPs

5 Countries

1164 kBTransfer

1342 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

votetanec.ru Open in urlscan Pro
188.114.97.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

94 %
HTTPS

50 %
IPv6

7
Domains

7
Subdomains

7
IPs

5
Countries

1164 kB
Transfer

1342 kB
Size

2
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!